Behavioral task
behavioral1
Sample
26f5f2131d033ae2ef64b80561794a2eded7d23a6a0f476085ee45fb5388e6d6.exe
Resource
win7-20240220-en
General
-
Target
26f5f2131d033ae2ef64b80561794a2eded7d23a6a0f476085ee45fb5388e6d6
-
Size
218KB
-
MD5
5da355b2e3cf6e0215d5b31fb2fbcffb
-
SHA1
8f47dc7ca8e8fbd3601e9221e3c5d32c35dc6530
-
SHA256
26f5f2131d033ae2ef64b80561794a2eded7d23a6a0f476085ee45fb5388e6d6
-
SHA512
d560ba8fe258a4379d0380717bf37fed000ef8c3f9b53a3214311dbf18038369111699ef2436522172448b14f59115f2d463e589ea661d9746ebc7430125fc04
-
SSDEEP
3072:4dl5YzDZo/ZqXpCgrYdrHl0yeJhFGULmDjwDqGDkqWniQacVLD84nbfrE/o4u:8jYbf0djCSUucuGDyiNELnnLrIo4
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5711013641:AAFQCl-5Y4KSCKb1njte7I7JzABT0FmJ3OU/
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 26f5f2131d033ae2ef64b80561794a2eded7d23a6a0f476085ee45fb5388e6d6
Files
-
26f5f2131d033ae2ef64b80561794a2eded7d23a6a0f476085ee45fb5388e6d6.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 215KB - Virtual size: 215KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ